From 4cc500a041026fde3b5d0e4b0e6f2253535fe9d2 Mon Sep 17 00:00:00 2001 From: Harshavardhana Date: Sun, 20 Dec 2020 10:09:51 -0800 Subject: [PATCH] normalize users with double // in accessKeys (#11143) Bonus fix, use constant time compare for secret keys in web-handlers.go:SetAuth() --- cmd/admin-handlers-users.go | 3 ++- cmd/web-handlers.go | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/cmd/admin-handlers-users.go b/cmd/admin-handlers-users.go index c6c6f4b94..046edc18b 100644 --- a/cmd/admin-handlers-users.go +++ b/cmd/admin-handlers-users.go @@ -22,6 +22,7 @@ import ( "io" "io/ioutil" "net/http" + "path" "github.com/gorilla/mux" "github.com/minio/minio/cmd/logger" @@ -358,7 +359,7 @@ func (a adminAPIHandlers) AddUser(w http.ResponseWriter, r *http.Request) { defer logger.AuditLog(w, r, "AddUser", mustGetClaimsFromToken(r)) vars := mux.Vars(r) - accessKey := vars["accessKey"] + accessKey := path.Clean(vars["accessKey"]) // Get current object layer instance. objectAPI := newObjectLayerFn() diff --git a/cmd/web-handlers.go b/cmd/web-handlers.go index 3371cdcb3..922d0d613 100644 --- a/cmd/web-handlers.go +++ b/cmd/web-handlers.go @@ -18,6 +18,7 @@ package cmd import ( "context" + "crypto/subtle" "encoding/json" "encoding/xml" "errors" @@ -1005,7 +1006,7 @@ func (web *webAPIHandlers) SetAuth(r *http.Request, args *SetAuthArgs, reply *Se } // Throw error when wrong secret key is provided - if prevCred.SecretKey != args.CurrentSecretKey { + if subtle.ConstantTimeCompare([]byte(prevCred.SecretKey), []byte(args.CurrentSecretKey)) != 1 { return errIncorrectCreds }